CVE-2026-92225
[20260912] - Core - XSS in module list
Published Sep 25, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-09-10 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92225 Description The module list layout did not properly escape user supplied values, leading to an XSS vector. Affected Installs Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: Google and Ada Logics
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-09-10 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92225 Description The module list layout did not properly escape user supplied values, leading to an XSS vector. Affected Installs Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3 Solution Upgrad
Sources
- Joomla SecurityVendor advisoryCVE-2026-92225
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-09-10 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92225 Description The module list layout did not properly escape user su
developer.joomla.org